Archive for the 'Family' Category

Aug 08 2010

Would you let your wife track your movement? I will

Published by under Apple/Mac,Family,Privacy

I make no secret of how much I value privacy.  Which is weird coming from someone like myself who spends so much time on social networking, blogging and generally shouting my activities to the world.  But I control most of that information, which is what privacy is all about in the digital age.  So why am I talking about letting my wife track my every move?  Because I received a press release about the Family Tracker application for the iPhone and iPad, and rather than just go on a diatribe about how such a system could be misused, I have decided that for the next few weeks I will voluntarily give my wife the ability to track the location of my iPhone anywhere it goes.  And since I’m almost never without my iPhone, it means she’ll be able to track my movement at all times.  Besides, she just gave me “the Look” when I asked if it was okay for me to track her movements; allowing her to track me was obviously a healthier choice.

I don’t like the idea of tracking of people, especially if they don’t know about it.  The potential for abuse far outweighs the benefits in most cases.  Whether it’s a spouse or parent abusing the tracking, someone abusing access to the vendor or law enforcement legally tracking someone, I get very nervous about what CAN happen.  So when I got the press release for Family Tracker and an offer for promotional codes, I decided it was time to bite the bullet that is my paranoia and see how a tracking program like this is used in real life. 

I travel.  A lot.  In the next few weeks I’ll be crossing the country several times and I’ll be gone from home more than I’ll be there.  I post my travel schedule on several calendars around my office, so which city I’m in is rarely a question and I use FourSquare enough that my location has never really been a mystery anyway.  But I’ve always been in control of both of these methods of tracking and giving my family a tool to tell where I am almost every moment of the day is new and interesting experience for me.  I suspect that my wife will look me up once or twice and then ignore the application 99% of the time.  But she has surprised me before.

I’ve set it up so I can track myself and my iPhone from my iPad, so even if my wife doesn’t want to track me, I can still find out more about what the program is capable off.  And unless I do something stupid that involves the police, I doubt anyone else will want to track me.  If anyone really wants to know my whereabouts, there’s more than enough information already on the Internet to find me if someone takes the time.  This will just make it a little easier.

So through the end of the month my little social experiment will be running. After that, we’ll see.  It may be that my wife likes being able to track me.  Or she may just say, “Meh.  If I want to know where you are, I’ll just call.”  I’m almost as interested in seeing how she uses Family Tracker as I am in seeing if she thinks being able to track me is worthwhile.  I honestly don’t know which way she’ll decide.

After the break is the information the folks at LogSat sent me when I expressed interest in their product, which covers several important questions about how Family Tracker works.
Continue Reading »

2 responses so far

May 21 2010

Rich will be on Science Friday today!

Published by under Family,Privacy

It’s only a couple of hours away, but Rich Mogull will be on Science Friday today talking about online privacy and Facebook.  I don’t know how much time he’ll have on the air, but he’s living a geek’s wet dream by getting on NPR and being asked about privacy.  I’m sure the show will be available as a podcast and online later, but I’ll be sure to listen in live.

No responses yet

Feb 24 2010

LMSD should have used due process

I make no secret about being a privacy advocate, however many people misunderstand what I’m against when I talk about our government spying on us.  I firmly believe that having the ability to monitor communications, search people’s houses and generally stick their noses in anywhere are all abilities that local and federal law enforcement agencies need to have.  But there’s one caveat I believe must be in place: for any sort of monitoring and spying there has to be oversight by a third party and a way to redress problems when someone abuses this power.  This oversight is one of the primary reasons cops have to go to judges to get a search warrant and we have many of the freedoms we do in the US.  Without oversight, we’d descend into a police state that matches the worst of our criticisms against countries such as China and Iran.  This is a lesson the administrators at the the Lower Merion School District forgot in their rush to use camera’s on student laptops to spy on the kids and prove wrong-doing that may or may not have been there.

Unless you’ve been hiding under a rock for the last week, you know about this case; quick recap is that a Vice Principal used a picture captured using LANRev on school provided laptops to accuse a student of taking drugs.  This prompted a class action suit and a potential criminal investigation into the district’s use of LANRev to illegally spy on students.  There’s a lot of damning evidence available on the Internet and it’s looking likely that a number of people will be facing criminal charges.  And it’s all because these people believed they were doing the right thing in tracking their laptops and their students without some form of oversight to tell them they were being complete and utter idiots.

Absolute Software, the makers of LANRev, understand that giving customers unrestricted access to spy using their computers is a major problem; they require that a police report be filed prior to the spying capabilities of their other, similar products such as LoJack are activated.  First of all, this creates the oversight advocates such as I crave.  Not too many people are going to report a laptop stolen so they can spy on their significant other.  Secondly it creates a paper trail that lays out when and why the spying capabilities were activated.  Even after these capabilities are up and running, it’s under the control of Absolute, not the end user.  In their own words this prevents “potential vigilantism” and other abuses of power. 

If what the families in the Lower Merion School District are claiming is true, and it appears more and more likely it is, then folks like the Vice Principal at Harrington High are definitely vigilantes, someone who illegally tries to mete out punishment to a criminal.  There’s a reason we have due process and the administrators of LMSD forgot all of them in their fervor to catch students doing things they shouldn’t at home.  They also forgot that the responsibility of schools and teachers is to teach, not law enforcement.  If they truly believed there was wrong doing going on, the police should have been called in and proper procedures should have been followed.  There’s still a good probability that using LANRev without a search warrant would have been considered an invasion of privacy, but if it was done with police involvement, there’s a lot lower chance they’d be in the hot water they’re in now.  And maybe someone with a little knowledge of the law would have said, “Hey, that’s one monumentally stupid idea you’ve got there.”

3 responses so far

Feb 23 2010

Hole in the system

Published by under Family,PCI,Simple Security

This one hit’s close to home quite literally; Andrew Storms had some major issues this weekend with how a pizza place close to his house handled his credit card information.  Andrew only lives a city or so away from me and the pizzeria is one that I might visit for lunch or dinner given the chance.  Or rather, I might have before I read his story.  Now I’ll probably avoid it, going some place where I have a little more hope they’ll treat my credit card and other personal information with a little more caution.

The short version of Andrew’s story is that he ordered a pizza online and when the owner/delivery guy showed up, he told Andrew he’d received the credit card number via email from the central corporate website in an email.  There are so many forms of wrong here that it’s hard to know where to start.  This is a violation of PCI, there’s a chance it’s a violation of several state and federal laws (depending on how card data is handled from this point on) and it is simply bad practice in general.  But the real problem came when Andrew tried to figure out how to report this and get the merchant to change how he’s doing business.  As best as we can figure out, there is no way for a consumer to report a merchant to the credit card companies or his acquiring bank. 

It’s a huge hole in the system.  The pizzeria is a very small chain, there’s a corporate web site that’s probably run by a third party and it’s mailing credit card numbers, along with other important PII like name and address.  Unless the owner is using a shredder, which I doubt, all it would take is one episode of dumpster diving for a local data breach to happen.  While the pizzeria probably doesn’t get more than a couple dozen online orders a week, even one breach is too many if it’s your credit card.

Consumers don’t have much power in the credit card system, but this is an egregious issue that should have some sort of reporting mechanism.  Andrew canceled his card and tried to report the merchant, but there’s literally no way I or anyone I know can think of to report the merchant and force some sort of change to their system.  Quite frankly they’re a Level 4 merchant who might have heard of PCI but has no idea it actually applies to them.  It’s not a problem of the merchant being malicious, it’s a problem of the merchant simply being ignorant of the problem and having bigger issues to worry about, such as trying to get a new business off the ground.  I don’t blame him, but I do want some form of reporting for situations like this so that consumers can be protected and merchants can be warned to stop practices that are dangerous to their customers.

2 responses so far

Feb 20 2010

Interview in the LMSD case

Here’s an interview with the family of the student who is at the center of the Lower Meridion School District.  I’m glad I didn’t see the interview before I’d written my previous post on the situation.  If what the family says is true, almost every statement that the school has made so far is false, from claiming that the spyware was only used 42 times to the statement that it was only activated when a laptop was reported stolen.  The Vice Principal accused Blake Robbins of trying to sell drugs online with proof of a picture taken from the laptop.  What Blake says he was really holding up weren’t drugs but candy.  And the Father hits the nail on the head in saying that his biggest concern is his 18 year old daughter who also has a school provided laptop with the same software installed.

I’m not exaggerating when I say I believe that the majority of the administration at the Lower Merion School District needs to be at least suspended pending investigation if not summarily fired!  The utter lack of moral and ethical compass that was required for this situation to come about is staggering.  I can understand wanting to protect an investment, but the slide from that to spying on school children should be obvious to anyone with a shred of common sense.  Lacking that much common sense tells me these people are unworthy of being in the school system and of teaching our children basic knowledge.  The LMSD is going to have to do serious damage control and their first step has to be keeping the people involved in this mess away from children.

This situation is going to have far ranging consequences and will hopefully change the way school administrators feel about monitoring students.  If you’re school district provides computers for your children, you need to make them aware of this situation and ask them if they’re doing anything similar.  If they answer yes, demand a full audit of the system and who accessed it immediately!  Don’t take ‘no’ for an answer; get a lawyer involved if you have to.  If you’re a teacher or an administrator who has similar software installed on laptops you’ve provided to your students, disable the program immediately and begin an audit of your systems and who accessed it.  It’s better to be proactive and discover that your system was abused than find out because you’re being hit with a lawsuit.

I’m putting down the keyboard now because I can barely express the outrage I feel at this situation. 

3 responses so far

Feb 20 2010

Don’t spy on my children!

I am amazed that the administration at Lower Merion School District (LMSD) couldn’t figure out something my eight year old son realized in just a few minutes, “Spying on people in their own home is wrong.  And really creepy.”  But they obviously couldn’t, so when they supplied 18oo students with Apple laptops 18 months ago, they included software with the laptops that would allow them to track stolen laptops and remotely turn on the iSight cameras on the Macs and take pictures of the thief.  Or pictures of a student doing something unnamed and naughty in his own home.  And then use that picture as evidence to prove that a student was doing something inappropriate in his own home.  After all, who’d ever think a teenager with a laptop would do something inappropriate when home, alone, with access to the Internet and all the sites that are normally forbidden to him?

When LMSD purchase 1800 Mac laptops for their student body, they made what was obviously a legitimate decision in their eyes: place software on the laptops that would allow the district to track their investment if it was lost or stolen.  These are laptops we’re talking about, they’re highly mobile and cost approximately $2000 each, so it’s understandable that the district might want to protect their investment.  But they never told the students or their parents that the software came as part of accepting the laptops.  As far as I can tell, the software installed was most likely one of the following:  LoJack, Undercover, MacTrak, BigFix or Hidden.  All of these systems are meant to be used to track stolen laptops, have the ability to turn on the camera remotely and can take screen captures and pictures through the Mac’s iSight camera.  There maybe several other solutions, and with the exception of BigFix, these are all consumer level products that are meant for one user to track one laptop and aren’t really meant for tracking a large number of users.  This is important because an enterprise version of this spyware is going to have significant logging capabilities, where as a consumer version might be utterly lacking in logging.  Allegedly, only two administrators had access to the systems for turning on the tracking and camera capabilities of the software.  What we’ll have to see now is what sort of logging the use of the software generated.  If it’s a consumer level product, I don’t have much hope for an accurate count, unless the tracking service itself keeps a log of how often the tracking of each laptop is turned on.  LMSD maintains that they “only” used the software 42 times or less than 50, their stories are conflicting.

I’ve been working in IT for a long time and a lot of my friends and acquaintances are people who would loosely be called ‘hackers’ by the public.  I don’t mean the people who are trying to break into your computer, I mean the people who test the limits of any system they come in contact with, just to see what it can do.  Most of the people I know who are good at their IT and computer security jobs are like this; they want to push the envelope so that they know what their systems can and cannot do.  Which is why having tracking and spying software on student laptops scares the snot out of me!  I know from personal experience that one of the first things the administrators of this system probably did was test it to see what they could and could not see from using the spying software, see if they’d be detected when it was turned on and see how they’d be tracked when they did turn on the spy software.  In and of itself, this attitude isn’t a bad thing, it’s part of the nature of the business we work in and the people it attracts.  But given the sensitive nature of who and where these laptops were going to be, unless there’s a complete, unmodifiable log of everything that was done using the spyware, I’m all but certain it was abused at least once during the time it was enabled on student laptops.

Another potential for abuse is exactly what happened to crack this whole issue wide open; a well meaning, if ignorant, Vice Principal used the capability of the spyware to take a picture of a student doing something he wasn’t supposed to.  It’s not clear yet exactly what the nature of the student’s abuse was, if his laptop had been reported stolen, if the software was activated for some other reason or if this was part of a systematic spying on the students.  What is known is that the Vice Principal used pictures taken from the iSight camera with the spying software to confront a student and his family with evidence of wrongdoing in a misguided attempt by the Vice Principal to do what she considered to be the right thing.  Unluckily for her, when it comes to spying on students at home, it’s much less of a slippery slope and more of a sudden drop off into the abyss of ‘1984‘.  I guess the whole school district skipped the ethics class when they were earning their teaching credentials.

The scariest potential abuses of this system both involve people who’d purposefully and knowingly break the rules the school set around this spying system.  Imagine if one of the administrators of the spyware was a closet pedophile or simply thought one of the students was much more mature than his or her years.  Students probably had their laptops sitting on their desks and undressed in front of them fairly often; after all, normal people don’t think their laptop is going to spy on them, so why bother turning it off or closing it before getting ready for bed.  Even worse is the thought that some student or malicious outsider (the classic media definition of ‘hacker’) found out that LMSD had this software installed and was able to break into the spyware system and use it at will.  These are merely suppositions, worse-case scenarios, but they are some of the factors that LMSD should have thought of before implementing spyware on student laptops.  A system such that has this much potential for abuse should have a similarly appropriate level of tracking, alerting and logging to prevent the curious and malicious from doing unethical, illegal and immoral.  Don’t be surprised if at some point in the near future pictures of LMSD students start showing up on the Internet.

The good news is that in addition to the civil suit the Lower Merion School District has been hit with, the FBI has started an investigation into the allegations of wrong doing.  The lawsuit alone is going to cost LMSD more than losing every last laptop would have, possibly by several orders of magnitude.  The business decision to track the laptops therefore turns out to be an utter failure.  Hopefully the FBI will be able to poke around the LMSD systems deeply enough that they’ll find any abuse of the system or confirm the districts assertion that the system was only used 42 times.  This is where all the logging capabilities of the spyware will be tested and the software vendor should expect a subpoena and visit from the FBI soon.  My suggestion to the FBI would be to pay special attention to any system administrator or school official that has had their computer recently re-imaged; while not proof of guilt, given the severity of the potential crimes that could be committed with the schools spyware, it’d be worth sending out the hard drives for recovery of the previous file system.
I truly hope that the FBI finds that the LMSD number of 42 times the spyware was used is accurate.  That would mean that most of my worst case scenarios haven’t happened.  But I suspect that even if the system wasn’t purposefully abused, 42 only represents the number of times that the spyware was used while going through the proper processes and procedures at the school district; it might have been used or abused many more times by the people who had access to it by design or by flaw.  And even if 42 is accurate, it will be up to a jury to decide if each of those uses were justifiable and legal.  In a civil court it’s going to be much harder for the school district to defend itself than it will be when the criminal charges are brought against the people responsible for the installation of the spyware.  And I’m confident that at least one person will be brought up on charges unless the whole school district is run and managed by people who are perfect angels.  Given that the system has already been abused, I’m pretty sure that supposition has been disproven.

I’m a parent of two pre-teen boys.  I probably wouldn’t have accepted a laptop from the school for either of them personally; I have more than enough computing power at home that I don’t need to bring someone else’s computer into the house.  And if this had happened in my school district, I’d be screaming for blood.  The school administrators who instigated and ran this program need to lose their jobs; they obviously don’t have enough of a moral compass to understand the difference between right and wrong and have no right to be working with children and teaching the next generation.  That may sound harsh, but these are people who thought that the security and safety of a few laptops was more important than the privacy and safety of the students who were using the same laptops.  A piece of hardware may be expensive, but it’s infinitely less important than my children and the children who live in the Lower Merion School District.  The inability to see that fact is proof of their utter lack of suitability to be working with children in the first place.

It may be that we find out that the spyware LMSD installed was never abused and that every instance of it’s use was justifiable.  But the installation and use of the system in the first place without notifying the parents and students was a utter and complete violation of these families civil liberties and right to privacy, not to mention the administrator’s ethical responsibility.  It shows that the school district placed more value on the laptops than the Constitutional rights of these families.  I find that unacceptable and hope that between the civil suit and the FBI investigation a strong message is sent to schools around the country that this sort of spying on students is not and never will be acceptable in any way, shape or form.  I hate to think about what I’d do if I ever found out my sons’ school district was spying on them in this way; there’s a reason I earned the nickname “Captain Privacy”. 

6 responses so far

Nov 04 2009

I’ll do anything! Absolutely anything!

Published by under Family,General,PCI

I love my children, I really do.  Especially when they remind me of some of the life lessons I learned long ago but have forgotten from my conscious mind.  And even more importantly when those life lessons are the same lessons that can be applied to the job I do on a daily basis.  Let me tell you a short story and how that relates to security in general and PCI specifically.

As we all know, Halloween was only a few days ago and many of us have large bowls filled with candy sitting around the house.  My house is no different and like many other parents, we’ve tried limiting the intake of candy by our kids to dessert and perhaps one or two pieces of candy throughout the day.  Today was no exception, so when my children asked if they could have dessert, I told them they could have one piece of candy each.  My eldest son thought this was fine, but my youngest son spent a fair amount of time rooting around his bowl and when I finally told him it was time to make a decision, the look he gave me told me something was up.  I had him open his hand and show me what was in it; not surprisingly, he’d tried to hide a second piece of hard candy in his hand, hoping I wouldn’t catch it and he’d get two pieces of candy.  Big no-no.

I was in a fairly understanding mood, so I simply took the second took the second piece of candy away and told him he could have the first piece of candy he’d picked.  He gave me the puppy dog eyes, which I ignored and told him that he’d made his choice and had to live with it.  Rather than eat that piece of candy, he said it wasn’t what he wanted threw it back in the bowl and walked away.  A few minutes went by, we told the boys to go brush their teeth and go to bed.  Cue the histrionics!

The screams went along the lines of “I’m not going to bed without dessert!” and “I’ll do anything for dessert!  Absolutely anything!”  Which was met with “You had your chance, you made your choice, now it’s too late.”  He screamed, he cried, he screamed some more.  But Daddy can be an immovable object when his mind is set, and a tired eight year old is going to bed whether he wills it or not, so Daddy won the argument.  We’ll see if he’s learned his lesson for tomorrow night’s desert.

How does this relate to security?  Often, at least from our point of view, management is much like a spoiled eight year old who wants what they want, when they want it and the consequences be damned!  As an assessor, I hear companies tell me about a date they have to be compliant by and they’ll do absolutely anything to meet with that date.  But when you start telling them what’s going to be required to be complaint, you start hearing all the excuses as to why particular pieces are impossible, can’t we just assess on what they will be doing in the future or ignore that part of the requirements since they’ll be doing it “really soon”.    I have about as much sympathy for them as I do for my son; I’m not the one who’s missing dessert, so he can either do what he’s supposed to or miss out on his sweets.

The cry of “I’ll do anything!” only lasts until it’s time to actually do something all to often.  I use compliance as an example, but this is just a big a problem in the rest of security.  Management sees another company in their market get compromised and says they’ll do anything to avoid the same fate.  Of course, ‘anything’ only lasts until they see the actual manpower and budgetary numbers that would be required to secure the company from the same fate that befell the the competitor.  And they get extra sensitive when told that the numbers you gave them will only protect them from the vulnerability du jour and additional resources will be required to become what you’d consider reasonably secure.

PCI is much the same way.  Business think they can get away with half-way measures that almost, sort of meet with the PCI requirements, but when a QSA comes in and says, “Let me see what’s in your other hand.”, the crying begins.  “I’ll do anything to be compliant!”  Well, start by writing policies that meet the minimum standards.  “Anything but that!”  Configure your firewalls so they aren’t swiss cheese allowing almost anything any “Well, anything but those two things!”  Implement a log manager.  “Anything but …” You get the picture; the definition of anything quickly narrows from the dictionary definition of ‘anything’ to ‘the absolute minimum I can get away with’.  It’s human nature to try to get as much as possible with as little effort as possible, whether your a mega-corporation or a eight year old.

PCI isn’t difficult, it’s a pretty minimum baseline for securing your company.  Risk vs compliance arguments aside, most of the things in PCI are measures the vast majority of businesses should be doing to establish a secure infrastructure that’s capable of keeping the bad guys out or detecting when they do get in.  The people who are screaming because it’s too hard are the same people who probably wouldn’t be giving the security and IT teams the resources needed to secure the enterprise in the first place.  And much like an eight year old they’d rather scream and cry after the fact than plan ahead, follow the rules and do the right thing in the first place.

You can’t send a corporation to bed without dessert and you can’t leave them unprotected.  Just like parenting, you have to do your best and hope that it’s the right thing.  Businesses are going to be much better served by trying to look ahead at what needs to done and how to do it effectively and efficiently rather than waiting until the last minute.  It’s a mark of maturity that many businesses may never show.  And again, just like a parent, it’s our job as security professionals to try to teach the businesses we work for how to plan ahead rather than screaming “I’ll do anything” when it’s already too late.

I think it’s time for me to go raid the candy bowl.  Unless my wife says it’s already too late.

4 responses so far

Mar 03 2009

Congratulations to the Mogulls

Published by under Family

Friend and co-host Rich Mogull is the proud father of a beautiful baby girl, Riley Marie Mogull.  The baby is doing well, the mother is doing well, and Rich is doing well.  I’m sure you’ll be hearing more from the proud father soon, but he’s going to take a couple of weeks off to take care of Mom and the new baby.  Smart man.

No responses yet

Dec 02 2008

Maxtor BlackArmor drive

Published by under Encryption,Family

At the end of October I was invited to a dinner put on by Seagate in San Francisco at Shanghai 1930 (highly recommend, BTW), along with a few other bloggers and a number of press folks.  I got to talk to a number of the Seagate executives and ended up sitting next to Luther Martin, the Chief Architect at Voltage Security.  The conversation was very fluid, ranging from politics to various security topics to the then upcoming holiday season.  There was nothing revolutionary in the conversation, though one of the execs in charge of consumer electronics said he felt very good about the future, since storage and backup in the home have barely scratched the surface of the market.  Finally on the way out, they handed each of us a Maxtor BlackArmor 320Gb external hard drive

The Maxtor drive is very nice, sleek and small.  It comes with a fairly short USB cable, pretty standard for these drives, and has a bright blue LED on the front to indicate activity.  And when I say bright, I mean it; the drive light’s up my office late at night and I really wish it had a way to dim or turn off the light, but that’s a minor quible.  When I plugged in the drive and started the software installation, it asked for the Security ID code from the back of the drive and a password, then acted just like any other drive on my computer.  Except none of my other drives are encrypted using AES-128 and require their own password before they’ll allow access. 

I’ve been running an older Maxtor Shared Storage drive on my network for several years now and love it.  It sits on the shelf and every night my files and my wife’s files get backed up over the network and I feel a bit more secure.  About every 3-4 months I take the whole backup and copy it to a second external drive hooked to the MSS drive via UPS, and once a year I copy those backups to a second external drive.  I’ve had drives fail on me before and I’m not willing to take a chance that my data would be lost in case of a drive failure.  Yes, I’m paranoid, but I’m a security professional and I’m supposed to be paranoid. The MSS runs a small program called Maxtor Quick Start that ran at startup and backed up everything, or at least it did until I installed the latest version of Maxtor’s software, Maxtor Manager.

I like the new Maxtor Manager, it works seamlessly, it backs up everything I want it to at Midnight every day, and my test restores have worked well so far.  The one issue I have with it is that it disabled Maxtor Quick Start from starting automatically upon bootup and doesn’t recognize my Maxtor Shared Storage Drive.  I can still start Quick Start manually and do backups to the networked drive by hand, but it doesn’t give me quite the same feeling of security I had before.  It is slightly redundant, I admit, since the BlackArmor drive is backing up the same drives nightly, but I’ve already stated that I’m a paranoid who only feels safe when I’ve got multiple copies of my data on backup. 

Other than the minor issues around my network and the bright blue LED, I love the Maxtor Black Armor drive.  I’m seriously considering purchasing one for a family member who’s in need of an external drive, especially since they aren’t any more expensive than your average external drive ($108 on Amazon for a 320Gb version).  The added security of having the encryption on the drive might not matter to many home users, but for folks like me who regularly work on sensitive documents, it’s a huge blessing and let’s me sleep a little better at night.  My issues with the software won’t affect most users and the backup software is easy enough to use that my luddite of a brother could install it and run it without any help from me.  Which is good, since I don’t do tech support, even for family.

9 responses so far

Nov 26 2008

Blocking YouTube with a WRT54G

Published by under Family,Firewall,Simple Security

Ahh, the joys of being a parent.  My youngest son recently started sprinkling his language with profanity, something both his mother and I were certain he didn’t get from us:  she almost never uses profanity and when I do the kids are usually running for cover rather than trying to remember what I said.  At first we thought he was getting it from school, but his older brother finally came forward and told us it was from videos he was watching on YouTube.  What had looked like a fairly innocuous video of SuperMario and other characters turned out to be profanity laden and more than a little disturbing.  He was given a warning and told to turn off any videos that contained profanity, then lost his computer rights for a week when I caught him watching a video with profanity.  The third time’s a charm, so I decided it’s time to block YouTube at the entry way, my WRT54G router.

It seemed simple and straight forward.  But an hour and several internet searches later, and I still couldn’t get the WRT54G to block YouTube.  I created a Policy called YouTube, rather appropriately, I added a list of affected PC’s, set it to everyday, 24 hours a day and entered in the space marked “Website blocking by URL address”.  Then hit “Save Settings” and … nothing.  I was still able to get to YouTube, the kids could get to YouTube and I was not happy.

Then it suddenly struck me: the folks at Linksys and Cisco were creating the software for the average computer user, someone who doesn’t have the faintest idea what “HTTP” or “URL” mean and probably never types the “http://” at the beginning of the URL.  I took that out of the URL and saved the settings and now YouTube is blocked.  I’m happy that I now know how to block a site, but I’m frustrated that the developers couldn’t have taken a few more lines of code to either automatically remove the http:// if typed in, or at the very least taken ten seconds to add an example of what they consider a URL.  If I’d seen even one example of what they consider a URL, I would have been able to block the site in less than 5 minutes, rather than taking over an hour.  And I wonder how many less technical parents have given up in frustration.

As someone put it on Twitter “Sometimes people should check acronym definitions before using them”

10 responses so far

« Prev